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EXAMINER'S ANSWER 



This is in response to the appeal brief filed February 28, 2005. 
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(1) Real Party in Interest 

A statement identifying the real party in interest is contained in the brief. 

(2) Related Appeals and Interferences 

The brief contains a statement that no related and/or interferences are pending. 

(3) Status of Claims 

The statement of the status of the claims contained in the brief is correct 

(4) Status of Amendments After Final. 

The Appellant's statement of the status of amendments after final rejection contained in 
the brief is correct 

(5) Summary of the Invention. 

The summary of the invention contained in the brief is correct. 

(6) Issues. 

The Appellant's statement of the issues in the brief is correct. 

(7) Grouping of Claims. 

The Appellant's brief includes a statement that the claims stand or fall together. 

(8) Claims Appealed. 

The copy of the appealed claims contained in the Appendix to the brief is correct. 

(9) Prior Art Record. 

6,158,010 Moriconi 1 2/2000 
WO 98/40987 Abraham 03/1998 

(10) Ground of Rejection. 
Claim Rejections - 35 USC §103 
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The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 

Claims 1- 24 are rejected under 35 U.S.C. 103(a) as being unpatentable over Moriconi et 
al (US Patent 6,158,010) in view of Abraham et al. (WO 98/40987). 

As per claim 1, 

Moriconi et al ('010) discloses a method for creating a privacy policy, comprising: 
moving a data element to the policy group;(Figure 9) 
generating a privacy policy based on the policy group. (Figure 4) 
Moriconi et al ('010) does not explicitly disclose creating a policy group, Abraham et al. 
('987) discloses creating a policy group. (Abstract) It would have been obvious to one having 
ordinary skill in the art at the time the invention was made to combine the Moriconi et al ('010)'s 
method with the Abraham et al. ('987)'s method in order to secure management of a computer 
network 

As per claim 2, 

Moriconi et al ('010) discloses the method of claim 1, 

wherein the data element is a predefined data element. (Column 6, lines 20-26) 
As per claim 3, 

Moriconi et al ('010) discloses the method of claim 1, 

wherein the data element comprises at least one sub-element.(Column 6, lines 46-51) 
As per claim 4, 

Moriconi et al ('010) discloses the method of claim 1, further comprising: 
updating a policy-wide property; and generating the privacy policy based on the policy- 
wide property. (Column 5, lines 48-55) 

As per claim 5, 

Moriconi et al ('010) discloses the method of claim 1, 

wherein the step of generating a privacy policy comprises generating a human readable 
version of the policy.(Column 9, lines 45-50 - Examiner notes that although Moriconi et al does 
not specifically disclose "generating a human readable version of the policy" it would be obvious 
that if the policy is manipulated via a GUI it would be readable to the user.) 

As per claim 6, 

Moriconi et al ('010) discloses the method of claim 5, 
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Official Notice is taken that "hypertext markup language version of the policy" is 
common and well known in prior art in reference to policy management. It would have been 
obvious to one having ordinary skill in the art at the time the invention was made to render the 
policy in HTML format in order to provide a format that is universally viewable across a wide 
variety of computer platforms and operating systems. 

As per claim 7, 

Moriconi et al ('010) discloses the method of claim 1, 

Official Notice is taken that "generating an extensible markup language version of the 
policy" is common and well known in prior art in reference to policy management. It would 
have been obvious to one having ordinary skill in the art at the time the invention was made to 
render the policy in XML format in order to provide a format that is universally viewable across 
a wide variety of computer platforms and operating systems. 

As per claim 8, 

Moriconi et al ('010) discloses the method of claim 1, 

wherein the step of generating a privacy policy comprises generating a compact 
policy.(Figure 4 - note element 436 optimizer) 

As per claim 9, 

Moriconi et al ( c 010) discloses the method of claim 1 5 

wherein the step of generating a privacy policy comprises generating a policy statement 
corresponding to the policy group.(Figure 4) 

As per claim 10, 

Moriconi et al ('010) discloses the method of claim 9, 

wherein the step of generating a privacy policy further comprises generating a table of 
policy elements, wherein a policy element in the table of policy elements corresponds to the 
policy statement. (Column 4, lines 34-37 — the rules [i.e. elements] are stored in a database [i.e. 
table]) 

As per claim 1 1 , 

Moriconi et al ('010) discloses the method of claim 1, further comprising: 
identifying an error in the privacy policy;(Column 11, lines 44-46 - Although Moricini 
does not specifically disclose generating an error statement describing the error he does disclose 
generating a log file, it is well known within modern computing systems to automate the 
generation of error reports from log files) 

As per claim 12, 

Moriconi et al ('010) discloses an apparatus for creating a privacy policy, comprising: 
movement means for moving a data element to the policy group;(Figure 9) 
generation means for generating a privacy policy based on the policy group. (Figure 4) 
Moriconi et al ('010) does not explicitly disclose creation means for creating a policy 
group, Abraham et al. ('987) discloses creation means for creating a policy group. (Abstract) It 
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Art Unit: 3621 

would have been obvious to one having ordinary skill in the art at the time the invention was 
made to combine the Moriconi et al ('OlO)'s apparatus with the Abraham et al ('987)'s 
apparatus in order to secure management of a computer network 

As per claim 13, 

Moriconi et al ( c 010) discloses the apparatus of claim 12, 

wherein the data element is a predefined data element.(Column 6, lines 20-26) 

As per claim 14, 

Moriconi et al ('010) discloses the the apparatus of claim 12, 

wherein the data element comprises at least one sub-element. (Column 6, lines 46-51) 

As per claim 15, 

Moriconi et al ('010) discloses the apparatus of claim 12, further comprising: 
means for updating a policy-wide property; and means for generating the privacy policy based on 
the policy-wide property.(Column 5, lines 48-55) 

As per claim 16, 

Moriconi et al ('010) discloses the apparatus of claim 12, 
wherein the generation means comprises means for generating a human 
readable version of the policy.(Column 9, lines 45-50 - Examiner notes that although Moriconi 
et al does not specifically disclose "generating a human readable version of the policy" it would 
be obvious that if the policy is manipulated via a GUI it would be readable to the user.) 

As per claim 17 

Moriconi et al ('010) discloses the apparatus of claim 16, 

Official Notice is taken that "hypertext markup language version of the policy" is 
common and well known in prior art in reference to policy management. It would have been 
obvious to one having ordinary skill in the art at the time the invention was made to render the 
policy in HTML format in order to provide a format that is universally viewable across a wide 
variety of computer platforms and operating systems. 

As per claim 1 8 

Moriconi et al ('010) discloses the apparatus of claim 19, 

Official Notice is taken that "generating an extensible markup language version of the 
policy" is common and well known in prior art in reference to policy management. It would 
have been obvious to one having ordinary skill in the art at the time the invention was made to 
render the policy in XML format in order to provide a format that is universally viewable across 
a wide variety of computer platforms and operating systems. 



As per claim 19, 

Moriconi et al ('010) discloses the apparatus of claim 12, 
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wherein the generation means comprises means for generating a compact policy.(Figure 4 
- note element 436 optimizer) 

As per claim 20, 

Moriconi et al ('010) discloses the apparatus of claim 12, 
wherein the generation means comprises means for generating a policy statement corresponding 
to the policy group. (Figure 4) 

As per claim 21 

Moriconi et al ('010) discloses the apparatus of claim 20, 

wherein the generation means further comprises means for generating a table of policy 
elements, wherein a policy element in the table of policy elements corresponds to the policy 
statement.(Column 4, lines 34-37 — the rules [i.e. elements] are stored in a database [i.e. table]) 

As per claim 22, 

Moriconi et al ('010) discloses the apparatus of claim 12, further comprising: means for 
identifying an error in the privacy policy;(Column 11, lines 44-46 - Although Moricini does not 
specifically disclose generating an error statement describing the error he does disclose 
generating a log file, it is well known within modern computing systems to automate the 
generation of error reports from log files) 

As per claim 23, 

Moriconi et al ('010) discloses an interface for creating a privacy policy, comprising: 
a first portion for displaying predefined data elements;(Column 9, lines 45-50) 
a second portion for displaying groups of data elements, wherein a group of data 
elements shares at least one common property;(Figure 4) 

Moriconi et al ('010) does not explicitly disclose a third portion for displaying a privacy 
policy generated from the groups of data elements, Abraham et al. ('987) discloses a third 
portion for displaying a privacy policy generated from the groups of data elements. (Abstract) It 
would have been obvious to one having ordinary skill in the art at the time the invention was 
made to combine the Moriconi et al ('OlO)'s method with the Abraham et al. ('987)'s method in 
order to secure management of a computer network 

As per claim 24, 

Moriconi et al ( c 010) discloses a computer program product, in a computer 
readable medium, for creating a privacy policy, comprising: 

instructions for moving a data element to the policy group(Figure 9) 
instructions for generating a privacy policy based on the policy group. (Figure 4) 
Moriconi et al ('010) does not explicitly disclose instructions for creating a policy group, 
Abraham et al. ('987) discloses instructions for creating a policy group.(Abstract) It would have 
been obvious to one having ordinary skill in the art at the time the invention was made to 
combine the Moriconi et al ('010)'s method with the Abraham et al. ('987)'s method in order to 
secure management of a computer network 
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(11) 



Response to Argument. 



First Issue 



A.l Claims 1-11 

The Examiner withdraws the rejection under 35 U.S.C 101 for claims 1-1 1 
A.2 Claims 12-22 

The Examiner withdraws the rejection under 35 U.S.C 101 for claims 12-22 
Second Issue 

B.l Claims 1,12 and 24 

In response to applicant's argument that the references to Moriconi et al (US Patent 
6,158,010) in view of Abraham et al. (WO 98/40987) are nonanalogous art, it has been held that 
a prior art reference must either be in the field of applicant's endeavor or, if not, then be 
reasonably pertinent to the particular problem with which the applicant was concerned, in order 
to be relied upon as a basis for rejection of the claimed invention. See In re Oetiker, 977 
F.2d 1443, 24 USPQ2d 1443 (Fed. Cir. 1992). In this case, the applicant makes a series of 
generalized assertions concerning the relationship between privacy and security. The Examiner 
holds that broad, generalizations as to the nature of the clients invention are inapplicable and that 
each claimed feature has been examined on it's own merits. The Moriconi reference describes a 
system by which a set of rules are applied to a set of users in a computer system, the examiner 
contends that in this specific instance the cited art demonstrates a policy for enforcing security 
and creating privacy at the same time. 

B.2. Claim 4 and 15 

The examiner maintains that the Moriconi reference meets the claimed limitation of 
"updating a policy wide property, and generating a privacy policy based on a policywide 
property" ; as Moriconi states "a system for managing and enforcing security requirements in a 
distributed computer network . . . and distributing a policy to a client" . The examiner contends 
that the management of a policy would include the updating of a policy and the distribution of 
the policy shows the adherence of multiple client tot a policywide property. 
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B.3. Claim 5 and 16 

The examiner maintains that if a Graphical User Interface is used then the content 
rendered by the GUI is obviously readable by humans. 

B.4. Claim 6,7, 17 and 18 

The examiner contends that the Applicant has made no formal challenge to the Official 
Notice taken in the prior rejections, 



| To adequately traverse such a finding, an applicant must specifically point out tlie 
supposed errors in die examiner's action, which would include stating why the noticed 

fact is not considered to be common knowledge oi ' well-known in the ait See 37 CF»R 
l.llj:(b). See also Chevenard, 139 F.2d at 713, 60 USPQ at 241 ('tl]n the absencie of 
any demand by appellant for the examiner to produce authoi% for liis statement, we 
\ not consider tliis contention. r '). A geneml allegation that the claims define a patentable .• ; . 
invention without any reference to the examiner's asseition of officml notice would be 
inadequate. If applicant adequately hm<ei^es the examiner's asseition of officialnotice, 
tlie examiner must provide docunientaiy evidence in tlie next Office action if the rejection 
is to be maintained. See 37 CFR 1.104(c)(2). See:also;2w^ v ^ 
j USP Q2 d at 1697 ("[T] he Board [or examiner] must point to some concrete evidence in 
! tlie record in support of these findings" to satisfy tlie substantial evidence test). Ktlie 
examiner is relying on pei^onal kno>^ 

ait, the examiner must prowle an affidavit or declaration setting forth specific fectiial r ^ 
statements and explanation to support the finding. See 37 CFR 1. Ip4(d)(2).? | 
If applicant does not traverse the examiner' s assertion of official notice or applicant 's 
I traverse is not adequate, the examiner should clearly indicate in the next Office action that 
■ tlie conunon knowledge or well-known in the ait statement is taken to be admitted prior 
[ ait because applicant either foiled to traverse the examiner's asseition of officialnotice or 
that the traverse was inadequate. If tlie traverse \\^ 
I nicliid^aii explanation as to why it was inadequate. / ' - x^w> :; v v - 

B.5. Claim 10 and 21 

The examiner contends that a table and a database are analogous features, Moriconi 
discloses a database (i.e. table) of policy rules and since the fules are a subset of the policy, 
each rule must correspond to at least one policy. 
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B.6. Claim 1 1 and 22 

The exainer contends that although Moricini does not specifically disclose generating an 
error statement describing the error he does disclose generating a log file, it is well known within 
modern computing systems to automate the generation of error reports from log files. 

B.7. Claim 23 

The examiner contends the Moriconi reference shows predefined data elements as per 
figure 9, i.e. users applications and roles, additionally Moriconi discloses different policies 
grouped within the database management system (element 218 of figure 4). Abraham 
discloses a graphical interface which communicates policies (Abstract) 



For the above reasons, it is believed that the rejections should be sustained, 



Respectfully submitted 
.-JobbM Winter 
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April 18,2005 
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